AbuseIPDBPopulateIndicators

Extracts IP addresses on block lists from AbuseIPDB, and Populates Indicators accordingly.

Details

ID	`AbuseIPDBPopulateIndicators`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`

README

Extracts IP addresses on block lists from AbuseIPDB, and populates indicators accordingly.

Script Data

Name	Description
Script Type	python
Tags

Dependencies

This script uses the following commands and scripts.

createNewIndicator
abuseipdb-get-blacklist

Inputs

Argument Name	Description
days	The time range to return reports for (in days). The default is 30.
limit	The maximum number of IP addressess to retrieve. The default is 50
confidence	The Minimum confidence required for the retrieved IPs. The default is 100.

Outputs

There are no outputs for this script.

Source

AbuseIPDBPopulateIndicators.py AbuseIPDBPopulateIndicators_test.py AbuseIPDBPopulateIndicators.yml

Download History Raw

commonfields:
  id: AbuseIPDBPopulateIndicators
  version: -1
name: AbuseIPDBPopulateIndicators
script: ''
type: python
subtype: python3
tags: []
comment: Extracts IP addresses on block lists from AbuseIPDB, and Populates Indicators accordingly.
enabled: true
args:
- name: days
  description: Time range to return reports for (in days).
  defaultValue: "30"
- name: limit
  description: 'Maximum number of IPs to retrieve.'
  defaultValue: "200"
- name: confidence
  description: 'The Minimum confidence required of IPs to retrieve.'
  defaultValue: "100"
scripttarget: 0
dependson:
  must:
  - '|||abuseipdb-get-blacklist'
  - Builtin|||createNewIndicator
timeout: 900ns
runas: DBotWeakRole
tests:
- AbuseIPDB PopulateIndicators Test
fromversion: 5.0.0
dockerimage: demisto/python3:3.12.13.10404775